Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/03/2024, 16:57
General
- Target 53fde37954908daa8acde4758d75f9614dd416ce1320650456e75874cee9a258.dll
- Size 1020KB
- Sample240310-vghkfsgf35
- SHA256 53fde37954908daa8acde4758d75f9614dd416ce1320650456e75874cee9a258
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\53fde37954908daa8acde4758d75f9614dd416ce1320650456e75874cee9a258.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\9HODR\dpapimig.exeC:\Users\Admin\AppData\Local\9HODR\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\gufou\sdclt.exeC:\Users\Admin\AppData\Local\gufou\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\TNA4s94\mspaint.exeC:\Users\Admin\AppData\Local\TNA4s94\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DUI70.dll
dpapimig.exe
MFC42u.dll
mspaint.exe
WTSAPI32.dll
sdclt.exe
Zleyjbxoi.lnk
MFC42u.dll
memory/1596-53-0x0000028E00470000-0x0000028E00477000-memory.dmp
memory/1596-52-0x00007FFAAB240000-0x00007FFAAB385000-memory.dmp
memory/1596-57-0x00007FFAAB240000-0x00007FFAAB385000-memory.dmp
memory/2172-45-0x00007FFABA530000-0x00007FFABA62F000-memory.dmp
memory/2172-0-0x00007FFABA530000-0x00007FFABA62F000-memory.dmp
memory/2172-2-0x000002E84ADF0000-0x000002E84ADF7000-memory.dmp
memory/2392-85-0x000001AC92770000-0x000001AC92777000-memory.dmp
memory/2392-86-0x00007FFAA86D0000-0x00007FFAA87D6000-memory.dmp
memory/2392-88-0x00007FFAA86D0000-0x00007FFAA87D6000-memory.dmp
memory/2692-68-0x00007FFAAB350000-0x00007FFAAB450000-memory.dmp
memory/2692-69-0x0000022916CB0000-0x0000022916CB7000-memory.dmp
memory/2692-73-0x00007FFAAB350000-0x00007FFAAB450000-memory.dmp
memory/3396-12-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-16-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-24-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-31-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-32-0x00007FFAC8B40000-0x00007FFAC8B50000-memory.dmp
memory/3396-33-0x00007FFAC8B30000-0x00007FFAC8B40000-memory.dmp
memory/3396-42-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-22-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-19-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-21-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-20-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-18-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-17-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-23-0x00000000010E0000-0x00000000010E7000-memory.dmp
memory/3396-15-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-6-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-14-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-13-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-11-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-10-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-9-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-8-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-7-0x00007FFAC8A4A000-0x00007FFAC8A4B000-memory.dmp
memory/3396-5-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3396-3-0x00000000012B0000-0x00000000012B1000-memory.dmp